AI tools can help summarize a brief, organize research, draft options, review code, or turn meeting notes into an action list. The risk begins when useful project context also contains personal information, credentials, confidential business material, or data that a client never agreed could be shared with another system.
The safest question is not simply, “Can AI do this task?” It is: What is the minimum information the task actually requires, and am I authorized to process it this way?
This checklist gives Filipino professionals and businesses a practical way to answer that question before project data enters an AI tool. It is educational guidance, not legal advice.
1. Classify the material before copying anything
Start by separating ordinary project context from information that needs tighter handling.
Lower-risk context may include:
- A generic description of a feature or workflow
- Public documentation supplied as a reference
- An anonymized error message
- A fictional example created specifically for testing
- Code with credentials, customer records, and proprietary identifiers removed
Higher-risk material may include:
- Names, email addresses, phone numbers, IDs, addresses, or account details
- Customer support conversations or interview transcripts
- Employee, applicant, patient, student, or financial information
- Authentication tokens, API keys, passwords, private URLs, or database exports
- Unreleased strategy, pricing, contracts, source code, designs, or internal reports
- Images, recordings, or documents that identify a person
Information being publicly visible does not automatically make unrestricted collection or reuse appropriate. The Philippine National Privacy Commission’s published guidance emphasizes lawful purpose, proportionality, transparency, and safeguards when personal data is processed.
2. Confirm authority and purpose
Before using client-supplied material with an AI system, confirm the intended purpose and who is authorized to decide.
- Is AI-assisted processing permitted by the contract, project policy, or written client instruction?
- Is the proposed use necessary for the agreed deliverable?
- Would the client reasonably expect this information to be processed by another provider?
- Are there sector-specific or organizational restrictions?
- Does the tool retain inputs, use them for training, or send them to another jurisdiction?
The National Privacy Commission’s guidelines for AI systems processing personal data place responsibility on organizations to establish governance mechanisms, apply privacy by design and by default, monitor systems, and enable meaningful human intervention where automated decisions may significantly affect people.
A professional should not silently convert a client relationship into permission for every available AI workflow.
3. Minimize and de-identify the input
If an AI tool is appropriate, provide only what the task needs. Replace real values with neutral placeholders:
- “Customer Maria Santos” becomes “Customer A”
- A real email becomes “customer@example.com”
- A production URL becomes “https://example.test/account”
- A real order number becomes “ORDER-001”
- A complete database row becomes only the fields necessary to explain the issue
Remove hidden context too. Documents and images may contain metadata, comments, revision history, geolocation, filenames, or background details that identify a person or reveal confidential operations.
Anonymization should be treated as a deliberate process, not a quick search-and-replace. A combination of role, location, date, and unusual circumstances may still identify someone even after a name is removed.
4. Keep secrets and production access out of prompts
Credentials should never be used as prompt context. Do not paste:
- API keys or access tokens
- Passwords or recovery codes
- Session cookies
- Private encryption keys
- Database connection strings
- Unredacted environment files
- Live payment or identity-verification records
If a credential is exposed, remove it from the conversation or workspace where possible, revoke it, rotate it, and review access logs. Merely deleting the visible message may not invalidate the secret. For troubleshooting, describe the credential type and expected behavior without including the credential itself.
5. Review the tool’s actual data controls
“AI-powered” is not a privacy specification. Before approving a tool, the business and professional should understand:
- What the provider collects and why
- How long inputs and outputs are retained
- Whether data is used to train or improve models
- Which subprocessors may receive it
- Where data may be stored or processed
- Which administrative, deletion, and access controls are available
- What happens when an account or project is closed
The relevant settings may differ between free, individual, team, enterprise, and API products. Verify the controls for the exact product and account type in use rather than relying on a general marketing page.
6. Keep a person responsible for the result
AI output can be incomplete, incorrect, biased, or based on assumptions that do not match the project. Human review is especially important when the result affects access, payment, eligibility, reputation, safety, or another person’s rights. The NIST AI Risk Management Framework is a useful additional reference for organizations establishing accountable AI risk practices.
The reviewer should be able to:
- Identify what source material was used
- Check factual statements against reliable sources
- Test code and calculations
- Detect missing requirements
- Reject an unsuitable output
- Explain the final decision without hiding behind the tool
The professional remains responsible for the submitted work. The business remains responsible for decisions made with it.
7. Agree on a simple project protocol
A short written protocol prevents uncertainty later. It can state:
- Which AI-assisted activities are allowed
- Which information must never be entered
- Whether anonymization is required
- Which approved tools and account types may be used
- Who reviews outputs before they affect the project
- How suspected exposure or incorrect output should be reported
- What project records must be retained or deleted at completion
This does not need to become a long policy for every engagement. A clear paragraph in the project brief or working agreement is often better than an assumption shared by nobody.
A two-minute pre-prompt check
- Purpose: Is this use necessary for the agreed task?
- Authority: Am I permitted to process this information here?
- Minimum: Can I remove more detail and still complete the task?
- Secrets: Have all credentials and production access details been excluded?
- People: Could the remaining information identify or harm someone?
- Provider: Do I understand the applicable retention and training settings?
- Review: Is a competent person accountable for checking the result?
- Record: Can I explain what was used and why if the client asks?
If any answer is unclear, stop and clarify before uploading the material.
Better AI use starts with a better brief
Privacy-safe work is usually more structured work. A clear project brief lets a professional ask focused questions, isolate the information needed for a task, and avoid feeding entire folders or conversations into a tool “just in case.”
For businesses hiring Filipino professionals, define the outcome, constraints, authorized systems, and sensitive-data boundaries when the project begins. For Filipino freelance professionals, disclose the proposed workflow when it materially affects how client information will be handled.
A structured project process and a clearer project brief make it easier to use only the information a task requires.
AI can accelerate parts of a project. Trust still depends on restraint, transparency, and accountable judgment.